chaosrebel/pico-openpgp
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-openpgp.git synced 2026-08-23 04:57:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Default generated keys to no touch

Browse Source 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos
2026-08-14 22:21:57 +02:00
parent 0fb3a0d7d2
commit 8abf9d323e
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openpgp/piv.c
+3 -2
View File
@@ -62,6 +62,7 @@
#define TOUCHPOLICY_ALWAYS 2
#define TOUCHPOLICY_CACHED 3
#define TOUCHPOLICY_AUTO 0xFF
#define PIV_DEFAULT_TOUCH_POLICY TOUCHPOLICY_NEVER
#define ORIGIN_GENERATED 0x01
#define ORIGIN_IMPORTED 0x02
@@ -1058,7 +1059,7 @@ static int cmd_asym_keygen(void) {
return SW_DATA_INVALID();
}
uint8_t def_pinpol = piv_default_pin_policy(key_ref);
uint8_t meta[] = {a80.data[0], tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : TOUCHPOLICY_ALWAYS, ORIGIN_GENERATED};
uint8_t meta[] = {a80.data[0], tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : PIV_DEFAULT_TOUCH_POLICY, ORIGIN_GENERATED};
if (meta_add(key_ref, CONST_BYTE_ARRAY(meta, sizeof(meta))) != PICOKEYS_OK || !flash_commit_sync(PIV_FLASH_COMMIT_TIMEOUT_MS)) {
return SW_MEMORY_FAILURE();
}
@@ -1536,7 +1537,7 @@ static int cmd_import_asym(void) {
return SW_WRONG_DATA();
}
uint8_t def_pinpol = piv_default_pin_policy(key_ref);
uint8_t meta[] = { algo, tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : TOUCHPOLICY_ALWAYS, ORIGIN_IMPORTED };
uint8_t meta[] = { algo, tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : PIV_DEFAULT_TOUCH_POLICY, ORIGIN_IMPORTED };
if (meta_add(key_ref, CONST_BYTE_ARRAY(meta, sizeof(meta))) != PICOKEYS_OK || !flash_commit_sync(PIV_FLASH_COMMIT_TIMEOUT_MS)) {
return SW_MEMORY_FAILURE();
}
tests/piv/test_060_regressions.py
+9
View File
@@ -133,3 +133,12 @@ def test_piv_card_authentication_key_is_pin_free_by_default(managed_piv):
assert response
finally:
delete_key(managed_piv, slot)
def test_piv_generated_key_uses_no_touch_by_default(managed_piv):
slot = SLOT.AUTHENTICATION
try:
managed_piv.generate_key(slot, KEY_TYPE.ECCP256, PIN_POLICY.ONCE, TOUCH_POLICY.DEFAULT)
assert managed_piv.get_slot_metadata(slot).touch_policy == TOUCH_POLICY.NEVER
finally:
delete_key(managed_piv, slot)